Imanami Community

I am working with a SQL table and Active Directory, and need to synchronize the two together using the 'mail' attribute as the primary key for the operation.

The problem is that in AD there are some users who do not have the mail attribute populated but who also have a contact record whose mail attribute IS populated (Notes users)

I want DTM to perform a query of the destination prior to sync'ing objects so that only user objects are returned and the job does not try to update the contact records. Is this possible?

CM

---

CarpMan

Hello CarpMan,

To update only user objects you can use multiple primary keys between the source and destination file.  Looking at ADSIEdit.msc on the properties of a contact, I see that "sAMAccountName" is not a contact attribute.  Every user account will have a sAMAccountName in Active Directory because it is used for logon purposes.  So use both the sAMAccountName and mail attribute as the primary keys to perform the update on user accounts only. 

If you have questions about the information provided, please post back with your response.  Looking forward to hearing from you soon.

 

Yes that's a great idea; my only problem is that sAMAccountName is not in the source database.

Is it not possible to reduce the scope of the destination object to just users OR to reduce the scope of the destination containers (the contact and user objects are in multiple OUs so it's not a simple job of selecting one destination OU!)

CM

---

CarpMan

Hello CarpMan,

 Do you have a field called: "Alias" or LogonID" in SQL?  If so, it should have the same information located in the sAMAccountName field for users in Active Directory.  Verify this by opening the property sheet of a user account in Active Directory and select the "Account" tab. The sAMAccount is located to the right of the "User logon name(pre-Windows 2000):" field.  Compare the value of sAMAcccountName with a field used in SQL that contains the logonID.  The column used in SQL for logonID or Alias will be mapped to the sAMAccountName in Active Directory when configuring the DTM job. 

In the meantime, I will check to see if there is another option that can be used to specify the exact objectClass to return and post the information back.

If you have questions about the information provided above, please let me know.  Looking forward to hearing from you soon.

 

I can guarantee that there's no login ID information/sAMAccountName column in this database - I wish there was, and this is why the only options I have are:

1. Limit the object type scope

2. Limit the container scope

3. Manually populate 15K+ rows of sAMAccountName values. No thanks!

CM

---

CarpMan

Hello CarpMan,

We can also use a Transform script to assimilate the behavior of the sAMAccountName naming convention used in Active Directory.  Can you provide an example of how the sAMAccountNames are formulated in Active Directory.  For example first letter of first name and full last name (rsoto).  The I can post back with a script and instructions on how to implement it in the DTM job.

Looking forward to hearing from you soon.

Unfortunately it's not that simple; with 15,000+ users there is a lot of duplication of givenName and sn attributes and  as manual processes have been used I can't guarantee that any formula would work apart from narrowing the problem down to a percentage of the users.

Have we identified that it is not possible to limit the object scope to a user, and not have the destination query pick up contacts?

CM

---

CarpMan

I am still looking into an option for using an objectClass filter.  I will post back the solution when I receive postive test results.